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Amendment to the Claims : 

This listing of claims replaces all prior versions, and 
listings, of clciims in the application: 

1. (currently amended) A method for real-time measurement 
of the performance of communi cat ions on a large area network 
^^i5^tween a select «sd server and a plurality of users, based upon 
ctual user experience, including: 

(a) accessing a server log having records indicative of 
routings of actu\al user access to the selected server; 

(b) aggregating records from the server log into a 
plurality of aggregate slots, each slot having at least one time 
bin which represent an interval of time/ based on an 
aggregation method; 

(c) performing ad least one statistical analysis separately 
on each time bin of each aggregate slot; and 

(d) outputting theYresults of such statistical analysis as 
an indication of actual alpcegg to server usage by users. 

2. (Original) The method of claim l f further including 
filtering out selected record^ from the server log before the 
step of aggregating. 
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i^^^J 3. Original) The method of claim 1, further including 



generating\an evesnt notification if a selected statistical 
analysis vaiue in abnormal ♦ 



@oos 



4. (Original) The method of claim 1, further including 
selecting the aggregation method from a set of aggregation 
methods . 




5, (Original) The method of claim 1, wherein the 
aggregation method includes aggregation by log- file record 
column data value: f or \each record from the server log. 



6 . (canceled) 



7. (Currently amended\ The method of claim [[6]] 34 , 
wherein determining geographical or source information for each 
record includes : 

(g) defining a database Comprising large area network 
address blocks halving geographical or source information; 

(h) comparing an address fdjeld in each record to the 
address blocks in the database; and 
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(io associating with each record the geographical or source 

f Y)^ \ \ 

information from an address block matching the address field of 

the record) 



8- (Original) The method of claim 7, wherein comparing an 
address field each record to the address blocks in the 
database include 

(j) defining \an array of binary trees for the address 
y\0 blocks in the database, each address block within a binary tree 
within an array calemeVt being masked by a corresponding unique 
subnet mask valuta; 

(k) masking each address field in each record by a unique 
subnet value corresponding to a selected array element; 

(1) comparing each masked address field to an address field 
of the address blocks within\the binary tree of the selected 
array element; 

(m) outputting selected fiWds of any matching address 
block; and 

(n) otherwise, continuing th^ step of comparing with a next 
selected array element until a match is found or all array 
elements have be»Bn compared. 
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9 . \(Original) The method of claim 1, further including: 
(o) determining exit routing paths from each selected 
server base\i on the records from the server log; 

(p) determining a best performing exit route based on the 
statistical analysis of records from the server log; 

(q) biasing incoming and outgoing communications with 
respect to each \erver to use the determined best performing 
exit route. 



10. (Withdrawn) A method for comparing an address field of 
a large area network record to a database comprising large area 
network address blocks having geographical or source 
information, inc] uding : 

(r) defining an arra^ of binary trees for the address 
blocks in the database, each\address block within a binary tree 
within an array element being \raasked by a corresponding unique 
subnet mask valu£:; 

(s) masking the address fi&ld of a large area network 
record by a unique subnet value c corresponding to a selected 
array element; 

(t) comparing each masked address field to an address 
field of the address blocks within the\binary tree of the 
selected array eLement; 
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r I \ 

^ 1 (v) dfcherwise, continuing the step of comparing with a 

next selected array element until a match is found or all array 
elements have\b€ien compared. 



11. (CurreAcly amended) A system for real-time measurement 
of the perf ormancte of communications on a large area network 
between a select -ad\ server and a plurality of users, based upon 
actual user experience, including: 

(w) a server locA having records with data indicative of 
routings of actual use* access to the selected server; 

(x) means for accessing and aggregating records from the 
server log into u plurality of aggregate slots, each having at 
least one time bin which represents an interval of time, based 
on an aggregation method ; 

(y) means for performing at least one statistical analysis 
of each time bin of each aggregate slot; and 

(z) means for outputting tke results of such statistical 
analysis as an indication of accAss to actual server usage by 
users . 



6 

Received from < 8586785099 > at 8/1103 8:12:41 PM [Eastern Daylight Time] 



08/64/2003 17:0$ FAI 8586785099 



FISH AND RICHARDSON 



12)009 



Attorney Docket No. 10559-096001 

Appl. NO. 09/4 71, 

Amdt. dated August 4, 2003 

Reply to office act. ton dated June 2, 2003 



12. (Previously presented) The system of claim 11, further 



O it, 



eluding means. Eor filtering out selected records from the 




server log betor^ the step of aggregating. 

13. (Original) The system of claim 11, further including 
means for generating an event notification if a selected 
V _ statistical analysi\s value is abnormal, 



- 14. (Original) T^e system of claim 11, further including 
means for selecting the\ aggregation method from a set of 
aggregation methods. 

15. (Original) The system of claim 11, wherein the 
aggregation method includes Aggregation by log- file record 
column data valu? for each re<iprd from the server log. 



16. (Original) The system on claim 11, further comprising: 
(aa) means :£or determining geographical or source 

information for each record; and 

(bb) means for selecting the aggregation method to 

aggregate record*; based on such geographical or source 

information. 
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y-> ^ / 1a (Original) The system of claim 16, wherein the means 
for determining geographical or source information for each 
record includes: 

(cc) a database comprising large area network address 
blocks havimg geographical or source information; 

(dd) a comparison function for comparing an address field 
in each record to the address blocks in the database; and 

(ee) an associating function for associating with each 
record the geographical or source information from an address 
block matching th& address field of the record. 

18. (Original) Vrhe system of claim 17, wherein the 
comparison function includes: 

(ff ) an array of binary trees from the address blocks in 
the database, each addreste block within a binary tree within an 
array element being masked\by a corresponding unique subnet mask 
value ; 

(gg) means For masking ekch address field in each record by 
a unique subnet value corresponding to a selected array element; 

(hh) means for comparing each masked address field to an 
address field of the address bocki^ within the binary tree of the 
selected array element; 
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£ \n (^y ( means for outputting selected fields of any matching 

address b^ock ;and 

(jj) nfleans for otherwise continuing the step of comparing 
with a next selected array element until match is found or all 
array elements\ have been compared. 




19. (Original) The system of claim 11 , further including: 
(kk) means foA determining exit routing paths for each 
selected server ba seel on the records from the server log; 

(11) means for determining a best performing exit route 
based on the stat;istical\analysis of records from the server 
log; 

(mm) means for biasing Ymcoming and outgoing communications 
with respect to e.ach server t$ use the determined best 
performing exit route. 



20. (Withdrawn) A system foA comparing an address field of 
a large area network record to a database comprising large area 
network address blocks having geographical or source 
information, including • 

(nn) an arr.ay of binary trees for tYte address blocks in the 
database/ each address block within a binary tree within an 
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rra>\ element being masked by a corresponding unique subnet mask 
value; 

(odi means for masking the address field of a large area 
network r&cord by a unique subnet value corresponding to a 
selected aita-ay element; 
y (pp) me^ns Eor comparing each masked address field to an 

CyC address field \of the address blocks within the binary tree of 
^ the selected aAray element ; 

(qq) means for indicating a match; and 

(rr) means f.or otherwise continuing the step of comparing 
with a next selected array element until a match is found or all 
array elements have been compared. 



21, (Currently amended) A computer program, stored on a 
computer-readable mediumX f or real-time measurement of the 
performance of communications on a large area network between a 
selected server and a plurality of users, based upon actual user 
experience, the computer program comprising instructions for 
causing a coputex system to: 

(ss) access a server log having records of routing of 
actual user acce.-ss to the selectedV server ; 
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(\t) aggregate records from the server log into a plurality 
of aggregate slots, each having at least one time bin, based on 
an aggregation method ; 

(uu) perform at least one statistical analysis of each time 
bin, representing a time interval, of each aggregate slot; and 

(w) output the results of such statistical analysis as an 
indication of efcctual server usage by users. 



22 „ (Origins^ The computer program of claim 21, further 
including instructions for causing the computer system to filter 
out selected records \from the server log before the step of 
aggregat ing . 

23. (Original) The Computer program of claim 21, further 
including instructions foA causing the computer system to 
generate an event notification if a selected statistical 
analysis value is*, abnormal , 



24. (Original) The computer\program of claim 21, further 
including instructions for causing; the computer system to select 
the aggregation method from a set of aggregation methods. 
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C^ t y?^y l 2 V (° ri 3 ilial ) The computer program of claim 21, wherein 
the aggi^egation method includes aggregation by log-file record 
column data value for each record from the server log. 




26. (Original) The computer program of claim 21, further 
including instructions for causing the computer system to: 

(ww) deteVnune geographical or source information for each 
record; and 

(xx) select Athe aggregation method to aggregate records 
based on such geographical or source information. 



27. (Original) ^he computer program of claim 26, wherein 
the instructions for dlausing the computer systems to determine 
geographical or nource Information for each record further 
include instructions forVcausing the computer system to: 

(yy) define a database comprising large area network 
address blocks having geographical or source information; 

(zz) compare an address\ field in each record to the address 
blocks in the database; and 

(aaa) associate with eachVecord the geographical or source 
information from an address bloc^ matching the address field of 
the record. 
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28. YOrigin.il) The computer program of claim 27, wherein 
the instructions, for causing the computer system to compare an 
address field in. each record to the address blocks in the 
database incJUide instructions for causing the computer system 
to : 

(bbb) define an array of binary trees for the address 
blocks in the database , each address block within a binary tree 
within an array element being masked by a corresponding unique 
subnet mask valuer; 

(ccc) make eacA address field in each record by a unique 
subnet value corresponding to a selected array element; 

(ddd) compare each masked address field to an address field 
of the address bJocks v^Lthin the binary tree of the selected 
array element; 

(eee) output selected fields of any matching address block; 

and 

(fff) otherwise, contirkie the step of comparing with a next 
selected array element until a match is found or all array 
elements have been compared. 
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I 29- Original) The computer program of claim 21, further 
C^J/^ including mat mictions for causing the computer system to: 
(ggg) determine exit routing paths from each selected 
server based ®n the records from the server log; 

(hhh) determine a best performing exit route based on the 
statistical ana]ysis of records from the server log; 

(iii) bias incoming and outgoing communications with 
respect to each server to use the determined best performing 
exit route. 



30. (withdrawn) A computer program, stored on a computer- 
readable medium, for comparing an address field of a large area 
network record to a database comprising large area network 
address blocks halving geographical or source information, the 
computer program comprising instructions for causing a computer 
system to; 

(jjj) define an array o¥ binary trees for the address 

blocks in the database, each address block within a binary tree 
within an array element being masked by a corresponding unique 
subnet mask value; 

(kkk) m;3Sk the address field a large area network 

record by a unique subnet value corresponding to a selected 
array element; 
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(111) \ compare each masked address field to an address 
field of the cfcddress blocks within the binary tree of the 
selected array Element; 

(mmm) indicate a match; and 

(xmn) otherwise, continue the step of comparing with a 

next selected arraA element until a match is found or all array- 
elements have been compared. 



Kindly add Lhe following new claims. 



31. (New) A n\ethod as in claim 1, wherein said statistical 

vr / 

analysis determines ^ime for specified user access relative to a 

. \ 

specified interval, a^d sorts said user access according to a 



number of .times that the application exceeds said interval . 




32. (New) A method\as in claim 1, wherein said server log 
includes a time stamp indicating when a record was formed, a 
client IP address, a time t\aken to complete transmission, and a 
size of the transmission. 



33. (New) A method as inXclaim 32, wherein said server log 
is formed by adding new data enory to the server log, and said 
server log is closed to further d^ta entry prior to said 
performing . 
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(New) A method as in claim 32, wherein said 
aggregating; comprises determining a geographic location from the 
IP address, Vnd aggregating IP addresses having a specified 
relationship With a specified geographical location . 



35. (New) \A method as in claim 32, further comprising 
/""Aggregating said\time bins into chronological order and 
determining trends\ among said time bins. 



36, (New) A method as in claim 32 # further comprising 
using said information to compute byte density, transfer rate, 
and error fraction. 

37. (New) A method as in claim 32, wherein said 
statistical analysis is an assessment of performance related 
measurement against a geographical location of a client . 



38. (New) h method as in claim 32, wherein said 
statistical analysis is an assessment of a route traversed 
during use of the: network application by an end user. 
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Cj^O 3|p , (N^w) A method as in claim 1, further comprising 

determining a\new path based on said results of said statistical 
analysis . 



40. (New) A system as in claim 11, wherein said server log 
includes a time stkmp indicating when a record was formed, a 
client IP address, A time taken to complete transmission, and a 
size of the transmission. 

41. (New) K system as in claim 40,, wherein said server log 
is formed by adding new data as entries to the server log/ and 
said server log ib closed ^o further data entry prior to said 
performing. 

42. (New) K system as iiA claim 40, wherein said accessing 
means converts the IP address into a geographic location, and 
aggregates IP addresses having a\specified relationship with a 
specified geographical location, 



43. (New) A system as in claim \40, wherein said 
statistical analysis is an assessment of performance related 
measurement against a geographical location of a client. 
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^-^^7 44. (N&w) a system as in claim 40, wherein said 
statistical analysis is an assessment of a route traversed 
during use of ctae network application by an end user. 




45. (New) A system as in claim 11, further comprising a 
communication rourdng part, determining a new path based on said 
results of said statistical analysis. 

46, (New) The computer' program as in claim 21, wherein 
said instructions to access the server log comprises 
instructions to access a\server log that includes time 
information about: records A client IP address, time taken to 
complete a transmission, arid a size of the transmission. 



47. (New) The computer program as in claim 46, wherein 
said instructions', to aggregate \include instructions to convert 
the IP address into information Vindicative of a geographical 
location, and to aggregate the information according to the 
geographical location. 



48. (New) The computer program Ws in claim 47, wherein 
said instruction/3 to perform a statistical analysis perform a 
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* \y statistical analysis of performance versus geographical location 

cif 1 




the client, 



49. (New) Tne computer program as in claim 47, wherein 
said instructions ko perform a statistical analysis perform the 
a statistical analyses assessing a route traversed during a 
network application. 



50. (New) The computer program as in claim 21 further 
comprising additional instructions to determine a new path based 
on results of said statistical analysis. 



19 

Received from < 8586785099 > at 8/4/03 8:12:41 PM [Eastern Daylight Time] 



